@jhizzard/termdeck 0.9.0 → 0.10.2

package/packages/server/src/index.js

@@ -56,6 +56,7 @@ const { SessionManager } = require('./session');
 const { initDatabase, logCommand, getSessionHistory, getProjectSessions } = require('./database');
 const { RAGIntegration } = require('./rag');
 const { createBridge } = require('./mnestra-bridge');
+const flashbackDiag = require('./flashback-diag');
 const { writeSessionLog } = require('./session-logger');
 const { TranscriptWriter } = require('./transcripts');
 const { createHealthHandler, runPreflight } = require('./preflight');
@@ -64,6 +65,7 @@ const { themes, statusColors } = require('./themes');
 const { loadConfig, addProject, updateConfig } = require('./config');
 const { createAuthMiddleware, verifyWebSocketUpgrade, hasAuth } = require('./auth');
 const { createSprintRoutes } = require('./sprint-routes');
+const { createGraphRoutes } = require('./graph-routes');
 const orchestrationPreview = require('./orchestration-preview');
 
 // Sprint 37 T3 — lazy resolution of T2's CLI modules. The orchestration-preview
@@ -170,6 +172,17 @@ function createServer(config) {
   const mnestraBridge = createBridge(config);
   console.log(`[mnestra-bridge] mode=${mnestraBridge.mode}`);
 
+  // Sprint 38 / T3 — let RAGIntegration delegate vector recall to the
+  // bridge so we don't duplicate the embed pipeline. Graph recall stays
+  // in rag.js because it's a different RPC and doesn't share the
+  // direct/webhook/mcp mode shape.
+  rag.setBridge(mnestraBridge);
+  if (rag.graphRecall) {
+    console.log(
+      `[rag] graph-aware recall ENABLED (depth=${rag.graphRecallDepth}, k=${rag.graphRecallK}, half-life=${rag.graphRecallRecencyHalflifeDays}d)`
+    );
+  }
+
   // Initialize transcript writer (Session Transcripts — Sprint 6)
   const transcriptConfig = config.transcripts || {};
   const transcriptEnabled = transcriptConfig.enabled !== undefined
@@ -841,30 +854,69 @@ function createServer(config) {
             question,
             project: sess.meta.project,
             searchAll: false,
+            cwd: sess.meta.cwd,
+            sessionId: sess.id,
             sessionContext: {
               type: sess.meta.type,
               project: sess.meta.project,
+              cwd: sess.meta.cwd,
               lastCommands: sess.meta.lastCommands.slice(-5),
               status: 'errored'
             }
           }).then((result) => {
-            const count = (result.memories || []).length;
+            const memories = (result && result.memories) || [];
+            const count = memories.length;
             console.log(`[flashback] query returned ${count} matches for session ${sess.id}`);
-            const hit = (result.memories || [])[0];
+            const hit = memories[0];
+            const wsReadyState = sess.ws ? sess.ws.readyState : null;
             if (!hit) {
               console.log(`[flashback] no matches — skipping proactive_memory send for session ${sess.id}`);
+              flashbackDiag.log({
+                sessionId: sess.id,
+                event: 'proactive_memory_emit',
+                ws_ready_state: wsReadyState,
+                frame_size_bytes: 0,
+                result_count_in_frame: 0,
+                outcome: 'dropped_empty',
+              });
               return;
             }
             if (sess.ws && sess.ws.readyState === 1) {
+              const frame = JSON.stringify({ type: 'proactive_memory', hit });
               try {
-                sess.ws.send(JSON.stringify({ type: 'proactive_memory', hit }));
+                sess.ws.send(frame);
                 console.log(`[flashback] proactive_memory sent to session ${sess.id} (source_type=${hit.source_type}, project=${hit.project})`);
+                flashbackDiag.log({
+                  sessionId: sess.id,
+                  event: 'proactive_memory_emit',
+                  ws_ready_state: 1,
+                  frame_size_bytes: Buffer.byteLength(frame, 'utf8'),
+                  result_count_in_frame: 1,
+                  outcome: 'emitted',
+                });
               } catch (err) {
                 console.error('[flashback] proactive_memory send failed:', err);
                 console.error('[ws] proactive_memory send failed:', err);
+                flashbackDiag.log({
+                  sessionId: sess.id,
+                  event: 'proactive_memory_emit',
+                  ws_ready_state: 1,
+                  frame_size_bytes: Buffer.byteLength(frame, 'utf8'),
+                  result_count_in_frame: 1,
+                  outcome: 'error',
+                  error_message: err && err.message ? err.message : String(err),
+                });
               }
             } else {
               console.log(`[flashback] ws not open for session ${sess.id} (readyState=${sess.ws ? sess.ws.readyState : 'null'}) — dropped hit`);
+              flashbackDiag.log({
+                sessionId: sess.id,
+                event: 'proactive_memory_emit',
+                ws_ready_state: wsReadyState,
+                frame_size_bytes: 0,
+                result_count_in_frame: count,
+                outcome: 'dropped_no_ws',
+              });
             }
           }).catch((err) => {
             console.error(`[flashback] query failed for session ${sess.id}: ${err.message}`);
@@ -902,6 +954,15 @@ function createServer(config) {
     getSession: (id) => sessions.get(id),
   });
 
+  // Graph endpoints (Sprint 38 T4) — knowledge-graph view backing graph.html.
+  // Reuses the petvetbid pg pool (same DATABASE_URL serves memory_items +
+  // memory_relationships alongside rumen_*). Graceful-degrades when the pool
+  // is absent.
+  createGraphRoutes({
+    app,
+    getPool: getRumenPool,
+  });
+
   // GET /api/sessions/:id - get session details
   app.get('/api/sessions/:id', (req, res) => {
     const session = sessions.get(req.params.id);
@@ -1326,6 +1387,23 @@ function createServer(config) {
     });
   });
 
+  // GET /api/flashback/diag - Sprint 39 T1 diagnostic ring buffer.
+  // Returns the last N Flashback decision-point events so Joshua can trigger
+  // a real-shell error and read the timeline of which gate dropped the toast.
+  // Optional filters: ?sessionId=<uuid>, ?eventType=pattern_match, ?limit=N
+  // (capped at 200, the ring size).
+  app.get('/api/flashback/diag', (req, res) => {
+    const { sessionId, eventType } = req.query || {};
+    const rawLimit = req.query && req.query.limit;
+    const limit = rawLimit != null ? parseInt(rawLimit, 10) : undefined;
+    const events = flashbackDiag.snapshot({
+      sessionId: typeof sessionId === 'string' && sessionId.length ? sessionId : undefined,
+      eventType: typeof eventType === 'string' && eventType.length ? eventType : undefined,
+      limit: Number.isFinite(limit) && limit > 0 ? Math.min(limit, flashbackDiag.RING_SIZE) : undefined,
+    });
+    res.json({ count: events.length, events });
+  });
+
   // ==================== Transcript endpoints (Sprint 6 T3) ====================
 
   // GET /api/transcripts/search - FTS across all sessions
@@ -1547,6 +1625,7 @@ function createServer(config) {
     const sessionContext = session ? {
       type: session.meta.type,
       project: session.meta.project,
+      cwd: session.meta.cwd,
       lastCommands: session.meta.lastCommands.slice(-5),
       status: session.meta.status
     } : null;
@@ -1556,6 +1635,7 @@ function createServer(config) {
         question,
         project,
         searchAll,
+        cwd: session ? session.meta.cwd : undefined,
         sessionContext
       });
 

package/packages/server/src/mnestra-bridge/index.js

@@ -10,6 +10,7 @@
 
 const { spawn } = require('child_process');
 const { resolveProjectName } = require('../rag');
+const flashbackDiag = require('../flashback-diag');
 
 function createBridge(config) {
   const mode = config.rag?.mnestraMode || 'direct';
@@ -225,7 +226,7 @@ function createBridge(config) {
     }
   }
 
-  async function queryMnestra({ question, project, searchAll, sessionContext, cwd }) {
+  async function queryMnestra({ question, project, searchAll, sessionContext, cwd, sessionId }) {
     // Flashback callers pass the session's project (from config.yaml). If that
     // slot is empty — e.g. a session created without an explicit project — fall
     // back to resolving the session's cwd against config.projects so queries
@@ -246,15 +247,68 @@ function createBridge(config) {
     // out-of-repo session-end hook), the mismatch surfaces here at query time.
     console.log(`[mnestra-bridge] query project=${effectiveProject ?? 'ALL'} source=${searchAll ? 'searchAll' : projectSource} mode=${mode}`);
 
-    switch (mode) {
-      case 'webhook':
-        return queryWebhook({ question, project: effectiveProject, searchAll });
-      case 'mcp':
-        return queryMcp({ question, project: effectiveProject, searchAll });
-      case 'direct':
-      default:
-        return queryDirect({ question, project: effectiveProject, searchAll });
+    const projectTagInFilter = searchAll ? null : (effectiveProject || null);
+    const t0 = Date.now();
+    let result;
+    let callError;
+    try {
+      switch (mode) {
+        case 'webhook':
+          result = await queryWebhook({ question, project: effectiveProject, searchAll });
+          break;
+        case 'mcp':
+          result = await queryMcp({ question, project: effectiveProject, searchAll });
+          break;
+        case 'direct':
+        default:
+          result = await queryDirect({ question, project: effectiveProject, searchAll });
+          break;
+      }
+    } catch (err) {
+      callError = err;
     }
+    const durationMs = Date.now() - t0;
+
+    // Sprint 39 T1 — bridge_query / bridge_result diag events. Emitted at
+    // queryMnestra's outer boundary so all three backends (direct, webhook,
+    // mcp) flow through one observability point. T3 reads project_tag_in_filter
+    // (the tag the bridge SENT to the RPC) and top_3_project_tags (the tags
+    // it GOT BACK) to confirm or refute the project-mismatch hypothesis.
+    flashbackDiag.log({
+      sessionId,
+      event: 'bridge_query',
+      project_tag_in_filter: projectTagInFilter,
+      query_text: typeof question === 'string' ? question.slice(0, 200) : '',
+      mode,
+      rpc_args: {
+        project: projectTagInFilter,
+        searchAll: !!searchAll,
+        project_source: searchAll ? 'searchAll' : projectSource,
+      },
+      duration_ms: durationMs,
+    });
+
+    const memories = (result && Array.isArray(result.memories)) ? result.memories : [];
+    const tagCounts = {};
+    for (const m of memories) {
+      const tag = m && m.project != null ? String(m.project) : '(null)';
+      tagCounts[tag] = (tagCounts[tag] || 0) + 1;
+    }
+    const top3 = Object.entries(tagCounts)
+      .sort((a, b) => b[1] - a[1])
+      .slice(0, 3)
+      .map(([tag, count]) => ({ tag, count }));
+
+    flashbackDiag.log({
+      sessionId,
+      event: 'bridge_result',
+      result_count: memories.length,
+      error_message: callError ? (callError.message || String(callError)) : null,
+      top_3_project_tags: top3,
+    });
+
+    if (callError) throw callError;
+    return result;
   }
 
   return { mode, queryMnestra };

package/packages/server/src/preflight.js

@@ -136,6 +136,82 @@ async function checkDatabase() {
   }
 }
 
+// Sprint 38 / T3 — graph-health check. Returns:
+//   pass : memory_relationships has rows AND last inferred_at < 48h ago
+//   warn : has rows but last inference > 48h ago (T2 cron may have drifted)
+//   fail : pg unreachable, table missing, or zero edges
+//
+// Reads `inferred_at` (T1's migration 009 column). Falls back to `created_at`
+// for the 749 pre-T2 edges that have no inferred_at value yet, so the check
+// doesn't perma-warn on the substrate that already exists.
+async function checkGraphHealth(config) {
+  // Only meaningful when graph features are enabled. Treat as pass with a
+  // descriptive detail so the banner doesn't FAIL on installs that haven't
+  // opted into graph recall yet.
+  const graphEnabled = config.rag?.graphRecall === true;
+  if (!graphEnabled) {
+    return { name: 'graph_health', passed: true, detail: 'graph recall disabled' };
+  }
+
+  const dbUrl = process.env.DATABASE_URL;
+  if (!dbUrl) {
+    return { name: 'graph_health', passed: false, detail: 'DATABASE_URL not set — cannot check graph' };
+  }
+
+  let pg;
+  try { pg = require('pg'); } catch (err) { pg = null; }
+  if (!pg) {
+    return { name: 'graph_health', passed: false, detail: 'pg module not installed' };
+  }
+
+  const pool = new pg.Pool({
+    connectionString: dbUrl,
+    max: 1,
+    connectionTimeoutMillis: 5000,
+  });
+
+  try {
+    // Single round-trip: edge count + last inference timestamp. coalesce on
+    // inferred_at so the substrate's pre-T2 edges register their created_at
+    // (otherwise max() returns NULL and the staleness check trips).
+    const res = await pool.query(
+      `SELECT
+         count(*)::int AS edges,
+         max(coalesce(inferred_at, created_at)) AS last_inferred_at
+       FROM memory_relationships`
+    );
+    const row = res.rows[0] || {};
+    const edges = Number(row.edges || 0);
+    if (edges === 0) {
+      return {
+        name: 'graph_health', passed: false,
+        detail: 'memory_relationships is empty — run T2 inference cron or seed edges manually',
+      };
+    }
+
+    const last = row.last_inferred_at ? new Date(row.last_inferred_at) : null;
+    if (!last) {
+      return {
+        name: 'graph_health', passed: true,
+        detail: `${edges.toLocaleString()} edges, last inference timestamp unknown`,
+      };
+    }
+
+    const agoMs = Date.now() - last.getTime();
+    const agoH = (agoMs / 3_600_000).toFixed(1);
+    const stale = agoMs > 48 * 3_600_000; // 48h cron drift threshold
+    return {
+      name: 'graph_health',
+      passed: !stale,
+      detail: stale
+        ? `${edges.toLocaleString()} edges, last inference ${agoH}h ago (stale — expected within 48h)`
+        : `${edges.toLocaleString()} edges, last inference ${agoH}h ago`,
+    };
+  } finally {
+    await pool.end().catch(() => {});
+  }
+}
+
 async function checkProjectPaths(config) {
   const projects = config.projects || {};
   const names = Object.keys(projects);
@@ -282,6 +358,10 @@ async function runPreflight(config) {
       name: 'shell_sanity', passed: false,
       detail: `check failed — ${err.message}`,
     })),
+    checkGraphHealth(config).catch((err) => ({
+      name: 'graph_health', passed: false,
+      detail: `check failed — ${err.message}`,
+    })),
   ]);
 
   const result = {
@@ -330,6 +410,7 @@ const REMEDIATION = {
   database_url: 'Set DATABASE_URL in ~/.termdeck/secrets.env',
   project_paths: 'Fix paths in ~/.termdeck/config.yaml → projects',
   shell_sanity: 'Check $SHELL and your login profile (~/.zshrc or ~/.bashrc)',
+  graph_health: 'Run T2 inference cron or apply migrations 009/010 to populate edges',
 };
 
 const CHECK_LABELS = {
@@ -339,6 +420,7 @@ const CHECK_LABELS = {
   database_url: 'Database',
   project_paths: 'Project paths',
   shell_sanity: 'Shell',
+  graph_health: 'Graph',
 };
 
 function printHealthBanner(result) {

package/packages/server/src/rag.js

@@ -46,10 +46,28 @@ class RAGIntegration {
     this.db = db;
     this.supabaseUrl = config.rag?.supabaseUrl || null;
     this.supabaseKey = config.rag?.supabaseKey || null;
+    this.openaiApiKey = config.rag?.openaiApiKey || process.env.OPENAI_API_KEY || null;
     this.enabled = !!(config.rag?.enabled && this.supabaseUrl && this.supabaseKey);
     this.syncInterval = config.rag?.syncIntervalMs || 10000;
     this._syncTimer = null;
 
+    // Sprint 38 / T3 — graph-aware recall toggle. When true, the recall()
+    // method routes through the new memory_recall_graph RPC (vector seed +
+    // graph expansion + combined re-rank). When false (default), it
+    // delegates to the existing mnestra-bridge vector path. The half-life
+    // mirrors the SQL function default (30 days) but is exposed here so
+    // callers can override it without re-deploying the migration.
+    this.graphRecall = config.rag?.graphRecall === true;
+    this.graphRecallDepth = Math.max(1, Math.min(5, config.rag?.graphRecallDepth ?? 2));
+    this.graphRecallK = Math.max(1, Math.min(50, config.rag?.graphRecallK ?? 10));
+    this.graphRecallRecencyHalflifeDays = config.rag?.graphRecallRecencyHalflifeDays ?? 30;
+
+    // Bridge reference for the vector-only recall path. Wired in by index.js
+    // after the bridge is created so we avoid duplicating the embed → RPC
+    // plumbing here. Optional: if absent, recall() with graphRecall=false
+    // throws a helpful error instead of silently returning empty.
+    this._bridge = null;
+
     // Table configuration matching Josh's multi-layer schema
     this.tables = {
       sessionMemory: config.rag?.tables?.session || 'mnestra_session_memory',
@@ -374,6 +392,126 @@ class RAGIntegration {
     this._statusWriteAt.clear();
   }
 
+  // Sprint 38 / T3 — wire the mnestra-bridge so vector-only recall delegates
+  // to the existing direct/webhook/mcp path instead of duplicating the embed
+  // pipeline here.
+  setBridge(bridge) {
+    this._bridge = bridge || null;
+  }
+
+  // Sprint 38 / T3 — graph-aware recall entry point. Returns the same shape
+  // as bridge.queryMnestra: { memories: [...], total }. Routes through the
+  // memory_recall_graph RPC when graphRecall is enabled, otherwise falls
+  // back to the bridge's vector path.
+  //
+  // options: { project?, searchAll?, sessionContext?, cwd?, depth?, k? }
+  async recall(query, options = {}) {
+    if (this.graphRecall) {
+      return this._recallViaGraph(query, options);
+    }
+    return this._recallViaVectorOnly(query, options);
+  }
+
+  async _recallViaVectorOnly(query, options) {
+    if (!this._bridge) {
+      throw new Error('RAGIntegration.recall: no bridge wired (call setBridge first)');
+    }
+    return this._bridge.queryMnestra({
+      question: query,
+      project: options.project,
+      searchAll: !!options.searchAll,
+      sessionContext: options.sessionContext,
+      cwd: options.cwd
+    });
+  }
+
+  // Direct REST call to memory_recall_graph (migration 010). Mirrors the
+  // bridge.queryDirect pattern: OpenAI embedding → Supabase RPC. Stays in
+  // rag.js so callers don't need to know which mnestra mode the bridge is
+  // using; graph recall is always direct-against-Postgres because the RPC
+  // doesn't ship as a Mnestra MCP tool yet (Sprint 38 / T1 wires the
+  // related MCP tools — graph recall lives here for now).
+  async _recallViaGraph(query, options) {
+    if (!this.supabaseUrl || !this.supabaseKey) {
+      throw new Error('graphRecall: supabaseUrl/supabaseKey not configured');
+    }
+    if (!this.openaiApiKey) {
+      throw new Error('graphRecall: OPENAI_API_KEY not configured');
+    }
+
+    const project = options.searchAll ? null : (options.project || null);
+    const depth = options.depth ?? this.graphRecallDepth;
+    const k = options.k ?? this.graphRecallK;
+
+    const embeddingRes = await fetch('https://api.openai.com/v1/embeddings', {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${this.openaiApiKey}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        model: 'text-embedding-3-large',
+        input: query,
+        dimensions: 1536
+      })
+    });
+    if (!embeddingRes.ok) {
+      const err = await embeddingRes.text();
+      console.error('[rag:graph] embedding failed:', err);
+      throw new Error('graphRecall: embedding generation failed');
+    }
+    const embeddingData = await embeddingRes.json();
+    const embedding = embeddingData.data[0].embedding;
+
+    console.log(`[rag] using graph recall path project=${project ?? 'ALL'} depth=${depth} k=${k}`);
+
+    const rpcBody = {
+      query_embedding: `[${embedding.join(',')}]`,
+      project_filter: project,
+      max_depth: depth,
+      k
+    };
+    const rpcRes = await fetch(`${this.supabaseUrl}/rest/v1/rpc/memory_recall_graph`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'apikey': this.supabaseKey,
+        'Authorization': `Bearer ${this.supabaseKey}`
+      },
+      body: JSON.stringify(rpcBody)
+    });
+    if (!rpcRes.ok) {
+      const err = await rpcRes.text();
+      console.error(`[rag:graph] RPC failed ${rpcRes.status}:`, err);
+      throw new Error(`graphRecall: memory_recall_graph RPC failed (${rpcRes.status})`);
+    }
+    const rows = await rpcRes.json();
+    return {
+      memories: rows.map((m) => ({
+        content: m.content,
+        // graph recall doesn't return source_type; preserve the bridge's
+        // shape by returning null so consumers don't crash on chip render.
+        source_type: m.source_type ?? null,
+        project: m.project,
+        // The bridge consumers read `similarity`; pass final_score so they
+        // see the combined (vector × edge × recency) signal as the badge.
+        // Also expose the underlying scores for callers that want to split
+        // them out (graph viz, debugging).
+        similarity: m.final_score,
+        depth: m.depth,
+        vector_score: m.vector_score,
+        edge_weight: m.edge_weight,
+        recency_score: m.recency_score,
+        path: m.path,
+        // memory_recall_graph doesn't return created_at — depth-N neighbors
+        // come from the graph walk, not a direct timestamp pull. Caller can
+        // re-fetch via memory_get if they need it.
+        created_at: m.created_at ?? null
+      })),
+      total: rows.length
+    };
+  }
+
   // Live-toggle for the dashboard RAG settings panel (Sprint 36 T3 Deliverable A).
   // Re-evaluates eligibility — flipping `enabled: true` without configured
   // Supabase creds is a no-op so the live integration never claims to be on

package/packages/server/src/session.js

@@ -14,6 +14,7 @@ const { v4: uuidv4 } = require('uuid');
 const os = require('os');
 const path = require('path');
 const { resolveTheme } = require('./theme-resolver');
+const flashbackDiag = require('./flashback-diag');
 
 // Strip ANSI escape codes for pattern matching
 function stripAnsi(str) {
@@ -43,6 +44,13 @@ const PATTERNS = {
     django: /Starting development server/,
     httpServer: /Serving HTTP on/,
     request: /(?:^|\s|")(GET|POST|PUT|DELETE|PATCH)\s+\S+.*?\s(\d{3})/m,
+    // Sprint 40 T2: HTTP 5xx response in a web-server log line is a real
+    // error condition for the application. Used as a python-server-typed
+    // fallback in _detectErrors when the prose-shape analyzers miss because
+    // the line carries no `Error:` keyword — just `"GET /foo HTTP/1.1" 503`.
+    // 5xx only (not 4xx, which are typically client-caused). The leading
+    // `(?:^|\s|")` mirrors `request` so colon-quoted log shapes still match.
+    serverError: /(?:^|\s|")(?:GET|POST|PUT|DELETE|PATCH)\s+\S+.*?\sHTTP\/\d(?:\.\d)?"?\s+5\d{2}\b/m,
     // Port detection — matches any of:
     //   • "port NNNN" phrase (capture group 1)
     //   • URL with http/https scheme, optionally prefixed with "on " or "at "
@@ -65,11 +73,20 @@ const PATTERNS = {
   // tools (cat, ls, cd, rm, etc.) report filesystem misses in plain English
   // without ever emitting the ENOENT errno code. Flagged as a gap by Rumen's
   // first production kickstart insight on 2026-04-15.
-  error: /(?:^|\n)\s*(?:Error:\s+\S|error:\s+\S|Traceback \(most recent call last\):|npm ERR!|error\[E\d+\]:|Uncaught Exception|Fatal:)/m,
+  // Sprint 40 T2: added uppercase `ERROR:` (mirrors `Error:` / `error:` for
+  // case-symmetry — closes the stripAnsi-ERROR test fixture from Sprint 33)
+  // and Node errno-style colon-prefix shapes (`ENOENT:`, `EACCES:`,
+  // `ECONNREFUSED:`) so `ENOENT: no such file or directory` shapes from
+  // child-process error reporting fire without depending on the line ALSO
+  // containing the `No such file or directory` prose phrase.
+  error: /(?:^|\n)\s*(?:Error:\s+\S|error:\s+\S|ERROR:\s+\S|Traceback \(most recent call last\):|npm ERR!|error\[E\d+\]:|Uncaught Exception|Fatal:|ENOENT:\s+\S|EACCES:\s+\S|ECONNREFUSED:\s+\S)/m,
   // Stricter line-anchored variant for Claude Code, whose tool output (grep
   // results, test logs, file contents) routinely mentions "Error" mid-line
   // without representing an actual failure of the agent itself.
-  errorLineStart: /^\s*(error|Error|ERROR|exception|Exception|Traceback|fatal|FATAL|segmentation fault|panic|EACCES|ECONNREFUSED|ENOENT|command not found|undefined reference|cannot find module|failed with exit code|No such file or directory|Permission denied)\b/m,
+  // Sprint 40 T2: added mixed-case `Fatal` (mirrors `fatal` / `FATAL`) and
+  // the `npm ERR!` shape (special-cased outside the alternation because
+  // `!` is not a word character so `\b` after `npm ERR!` doesn't match).
+  errorLineStart: /^\s*(?:(?:error|Error|ERROR|exception|Exception|Traceback|fatal|Fatal|FATAL|segmentation fault|panic|EACCES|ECONNREFUSED|ENOENT|command not found|undefined reference|cannot find module|failed with exit code|No such file or directory|Permission denied)\b|npm ERR!)/m,
   // Sprint 33: PATTERNS.error misses the most common Unix shell errors —
   // `cat: /foo: No such file or directory`, `bash: foo: command not found`,
   // `rm: cannot remove ...: Permission denied`. These have a colon-prefix
@@ -77,7 +94,27 @@ const PATTERNS = {
   // mentioning the same words. Each branch requires either the colon-prefix
   // structure or a stand-alone anchored keyword. Validated against an
   // adversarial prose suite (see tests/analyzer-error-fixtures.test.js).
-  shellError: /(?:^|\n)(?:[^\n]*:\s+(?:.*?:\s+)?(?:No such file or directory|Permission denied|Is a directory|Not a directory|command not found)\b|[^\n]*?\(\d+\)\s+Could not resolve host\b|\s*ModuleNotFoundError:\s+\S|\s*Segmentation fault\b|\s*fatal:\s+\S)/m
+  //
+  // Sprint 39 T2: separated `command not found` from the other phrases. The
+  // unified branch was matching rcfile-noise lines emitted by version
+  // managers during shell startup — most notably:
+  //   `pyenv: pyenv-virtualenv-init: command not found in path`
+  // …which has the colon-prefix-with-`command not found` shape but with a
+  // descriptive suffix (` in path`) rather than ending the line. The pyenv
+  // case confirms the strong rcfile-noise hypothesis for pyenv users: their
+  // shell startup burns the 30s onErrorDetected rate limit before the user
+  // can type their first command. The dedicated `command not found` branch
+  // below requires the keyword to be either:
+  //   • followed by `:` (the zsh `command not found: <cmd>` form), or
+  //   • at end-of-line (the bash `<sh>: <cmd>: command not found` form).
+  // Suffixes like ` in path`, ` in $PATH`, ` (compinit)` are silenced as
+  // rcfile noise.
+  // Trade-off: custom command_not_found_handler output that adds a comma-
+  // separated "did you mean X" suggestion is silenced — those are cosmetic
+  // suggestions, not the error itself, which the user already saw fire.
+  // See tests/rcfile-noise.test.js and tests/analyzer-error-fixtures.test.js
+  // for the locked corpus.
+  shellError: /(?:^|\n)(?:[^\n]*:\s+(?:.*?:\s+)?(?:No such file or directory|Permission denied|Is a directory|Not a directory)\b|[^\n]*:\s+(?:.*?:\s+)?command not found(?::|\s*(?:[\r\n]|$))|[^\n]*?\(\d+\)\s+Could not resolve host\b|\s*ModuleNotFoundError:\s+\S|\s*Segmentation fault\b|\s*fatal:\s+\S)/m
 };
 
 class Session {
@@ -350,14 +387,44 @@ class Session {
     // Claude Code's tool output frequently contains "error"/"Error" mid-line
     // (grep matches, test results, log dumps). Use a line-anchored pattern
     // for that session type so we don't flag content as failure.
-    const pattern = this.meta.type === 'claude-code'
+    const primaryPattern = this.meta.type === 'claude-code'
       ? PATTERNS.errorLineStart
       : PATTERNS.error;
+    const primaryName = this.meta.type === 'claude-code' ? 'errorLineStart' : 'error';
     // Sprint 33 fix: the structured patterns above miss `cat: /foo: No such
     // file or directory` and friends — the most common Unix shell error
     // shapes Josh hits day-to-day. Fall through to PATTERNS.shellError so
     // the analyzer flips status='errored' and Flashback can fire.
-    if (!pattern.test(clean) && !PATTERNS.shellError.test(clean)) return;
+    const primaryMatch = clean.match(primaryPattern);
+    const shellMatch = !primaryMatch ? clean.match(PATTERNS.shellError) : null;
+    // Sprint 40 T2: HTTP 5xx fallback for python-server sessions. The prose
+    // analyzers miss `"GET /foo HTTP/1.1" 503 -` because it carries no
+    // `Error:` keyword — but the response IS the error signal for an
+    // HTTP-server session. Gated on session type to avoid flagging 5xx
+    // status codes that legitimately appear in unrelated content (e.g. a
+    // shell that just printed a copy of an HTTP log).
+    const serverMatch = (!primaryMatch && !shellMatch && this.meta.type === 'python-server')
+      ? clean.match(PATTERNS.pythonServer.serverError)
+      : null;
+    if (!primaryMatch && !shellMatch && !serverMatch) return;
+
+    // Sprint 39 T1 — pattern_match diag event. Emitted on every PATTERNS hit,
+    // including ones that get rate-limited downstream. T2 reads these to
+    // measure the rcfile-noise false-positive rate against real shell output.
+    const matchedSrc = primaryMatch || shellMatch || serverMatch;
+    const matchedLine = (matchedSrc && typeof matchedSrc[0] === 'string')
+      ? matchedSrc[0].replace(/^\n+/, '').slice(0, 200)
+      : '';
+    const matchedPattern = primaryMatch
+      ? primaryName
+      : (shellMatch ? 'shellError' : 'serverError');
+    flashbackDiag.log({
+      sessionId: this.id,
+      event: 'pattern_match',
+      pattern: matchedPattern,
+      matched_line: matchedLine,
+      output_chunk_size: clean.length,
+    });
 
     const oldStatus = this.meta.status;
     this.meta.status = 'errored';
@@ -371,7 +438,30 @@ class Session {
 
     // Server-side rate limit: at most one error_detected event every 30s per session
     const now = Date.now();
+    const remainingMs = this._lastErrorFireAt
+      ? Math.max(0, 30000 - (now - this._lastErrorFireAt))
+      : 0;
+
+    // Sprint 39 T1 — error_detected diag event, before the rate-limit gate.
+    // The (error_detected count − rate_limit_blocked count) is the number of
+    // errors that actually got dispatched to onErrorDetected. T2/T3 use this
+    // to spot rcfile noise burning the rate-limit window before real errors.
+    flashbackDiag.log({
+      sessionId: this.id,
+      event: 'error_detected',
+      error_text: matchedLine,
+      rate_limit_remaining_ms: remainingMs,
+      last_emit_at: this._lastErrorFireAt
+        ? new Date(this._lastErrorFireAt).toISOString()
+        : null,
+    });
+
     if (now - this._lastErrorFireAt < 30000) {
+      flashbackDiag.log({
+        sessionId: this.id,
+        event: 'rate_limit_blocked',
+        rate_limit_remaining_ms: remainingMs,
+      });
       console.log(`[flashback] error detected in session ${this.id} but rate-limited (${Math.round((30000 - (now - this._lastErrorFireAt)) / 1000)}s left)`);
       return;
     }